The vulnerability identified as CVE-2026-66602 is a CSRF flaw in the DevItems HashBar – WordPress Notification Bar plugin for WordPress. It affects all versions up to 2.0.0. The flaw allows attackers to trick authenticated users into submitting unwanted requests, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this CSRF vulnerability could allow attackers to execute unauthorized actions with the privileges of an authenticated user, potentially leading to complete compromise of the affected WordPress site’s confidentiality, integrity, and availability.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or restricting use of the HashBar plugin to mitigate risk.